Executive brief
Spring Cloud Sleuth is a distributed tracing library used by Java applications to track requests across microservices. A vulnerability in the Spring TX instrumentation component allows unauthenticated attackers to craft malicious requests that exhaust system resources, causing the application to become unavailable. This affects applications using vulnerable versions unless Spring TX instrumentation is explicitly disabled.
Technical details
The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption) within the Spring TX instrumentation component of Spring Cloud Sleuth. An attacker can exploit this by sending specially crafted transaction-related calls over the network without authentication, triggering excessive resource allocation that exhausts memory, CPU, or connection pools. Attack complexity is low and no user interaction is required. The vulnerable versions are 3.1.0 through 3.1.13; mitigation is available by disabling Spring TX instrumentation. As of the advisory date (June 2026), no patch version has been released, though the vulnerability can be avoided through configuration changes.
Affected products
- VMware Spring Cloud Sleuth instrumentation 3.1.0 through 3.1.13
Timeline
- 2026-06-15: disclosed
- 2026-08-26: advisory: GitHub Advisory Database reviewed